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The concept of warning behaviors offers an additional perspective in threat 
assessment. Warning behaviors are acts which constitute evidence of increasing or 
accelerating risk. They are acute, dynamic, and particularly toxic changes in patterns 
of behavior which may aid in structuring a professional’s judgment that an individual 
of concern now poses a threat — whether the actual target has been identified or not. 
They require an operational response. A typology of eight warning behaviors for 
assessing the threat of intended violence is proposed: pathway, fixation, identification, 
novel aggression, energy burst, leakage, directly communicated threat, and last resort 
warning behaviors. Previous research on risk factors associated with such warning 
behaviors is reviewed, and examples of each warning behavior from various intended 
violence cases are presented, including public figure assassination, adolescent and 
adult mass murder, corporate celebrity stalking, and both domestic and foreign acts of 
terrorism. Practical applications and future research into warning behaviors are 
suggested. Copyright © 2011 John Wiley & Sons, Ltd. 


Discussions of threat assessment and targeted violence have their origins in the 19th 
century work of Laschi and Lombroso (Laschi & Lombroso, 1886; Lombroso & 
Laschi, 1892) in Italy and Régis (1890) in France. Since the contemporary research of 
Dietz and Martell (1989), Fein, Vossekuil and Holden (1995), Fein and Vossekuil 
(1998, 1999), and Calhoun (1998), threat assessment has advanced in a variety of 
areas, with studies in different domains of intended and targeted violence such as 
workplace violence, campus and university violence, school shootings, public figure 
assassination, adolescent and adult mass murder, terrorism, and the development of 
both threat assessment protocols and threat assessment organizations. As the nascent 
discipline of threat assessment matures, it is pertinent to revisit and refine terminology 
to standardize both practice and further research. One such concept is that of 
“warning behaviors” (James et al., 2007, 2008, 2011), variously termed by others as 
“signaling the attack” (Vossekuil, Reddy, Fein, Borum, & Modzeleski 2000), “tell-tale 
behaviors” or “high risk indicators” (Calhoun & Weston, 2003), “stalking-type 
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behavior” (Mullen et al., 2009) and “pre-attack signals” (Dietz & Martell, 2010). 
These concepts in turn are also closely linked to those of “leakage” (Meloy & O’Toole, 
2011; O’Toole, 2000) and behaviors on a “pathway to violence” (Calhoun & Weston, 
2003; Fein et al., 1995). Below, some of the concepts elaborated by such authors are 
organized into a unified framework of “warning behaviors.” In this article the authors 
define the term, place it in the context of violence risk and threat assessment, trace its 
genesis through existing risk and threat assessment literature, discuss various types and 
illustrative case examples of warning behaviors, theorize on the reasons for warning 
behaviors, and make suggestions for operational application and further research. 


SETTING THE CONTEXT 
Threat Assessment and Risk Assessment 


Threat assessment and risk assessment have developed as somewhat overlapping fields. 
Violence risk assessment has an older provenance, and is a method by which the 
probability of generally violent behavior is estimated for an individual based upon his 
membership in a particular at-risk group. Threat assessment is concerned almost 
wholly with the risk of targeted violence’ by a subject of concern, and has a behavioral 
and observational policing focus. Risk assessment may address different domains of 
risk than threat assessment, and typically relies on more historical and dispositional 
(status) variables. 

Threat and risk assessment both involve the reaching of a professional judgment by 
a person trained in such assessment. In a violence risk assessment, judgment is 
informed, but not necessarily dictated, by structured consideration of the presence or 
absence in a given case of factors which have been found through research to be 
statistically associated with violence. These are termed risk factors, and they are 
produced from analysis of group data. The problem of describing risk of intended or 
targeted violence in any given individual (as opposed to a group) is the very low base 
rate in any population under consideration, and the guarantee of an unacceptably high 
false-positive rate. Given the very low base rate, predicting which subject will be violent 
among those at risk for violence is impossible. Risk factors allow the separation of 
individuals into risk groups, typically high, medium, or low. Typing someone as high 
risk is not a probability estimate that he or she will behave in a violent way; rather, it is a 
statement that the subject shares important statistical associations with that group of 
people from which the few individuals who will go on to commit the behavior are most 
likely to emanate. 

Risk factors are usually placed in the framework of an “instrument” or “protocol,” 
in other words a structured formulation (or aide-mémoire) of such factors, which can be 
applied by the violence risk assessor to ensure that all relevant risk factors are 
considered and incorporated into the assessor’s judgment (Skeem & Monahan, 2011). 
All violence risk factors can be divided into those that are static (status) and 
not susceptible to change (e.g., previous convictions for violence, gender) and 





' Targeted or intended violence is inherently predatory (instrumental) and not affective (reactive, 
impulsive), whereas general violence risk assessment is concerned with both modes of violence, but has 
historically not differentiated between the two when instrumentation has been developed (Meloy, 2006). 
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those that are dynamic (state) and changeable (e.g., weapons possession, drug use, 
proximity-seeking). The latter can act as potential management targets for lowering 
risk. Recent work has emphasized the usefulness of further dividing state factors into 
those that do slowly change over time (stable) and those that can rapidly change over 
time (acute) (Douglas & Skeem, 2005). Most structured instruments — heretofore the 
domain of risk assessment rather than threat assessment — divide risk into one of three 
to five summary risk categories, at least three of them often labeled low, moderate, or 
high risk [see, for example, the HCR-20 (Webster, Douglas, Eaves & Hart, 1997); 
Monahan & Steadman, 1996]. 

In risk assessment, there is often a history of violence and the evaluation is usually 
done in a static setting, in other words one where the person is in a contained 
environment, such as prison or hospital (e.g., evaluation for release from prison to 
parole). In threat assessment, there may be no history of violence. Intelligence has 
developed around a subject of concern which has placed him or her on the radar of the 
threat assessor, and the evaluation is often acutely dynamic, unfolding in real time as 
the threat evolves toward an identified or as yet unidentified target (Borum, Fein, 
Vossekuil & Bergland, 1999). 


Risk or Level of Concern? 


An adjunctive concept to risk is that of “level of concern” (Scalora et al., 2002a). 
Concern differs from risk in two main ways. The concept of level of concern is 
particularly applicable to threat assessment in dynamic, operational conditions, 
because it is judged on what information is currently available, which may be quite 
incomplete. A risk judgement, by contrast, requires all relevant information to have 
been gathered. Secondly, concern levels can reflect circumstance. For instance, a man 
who is assessed as being at high risk of violence will become of low concern if 
intervention results in his incarceration in a high-security facility, even if his risk level 
remains the same. Concern levels, as with risk levels, are generally rated as high, 
moderate, or low. The proportion of high-concern individuals who will act if no 
intervention is taken is probably rather small. However, few who go on to act will not 
come from the high-concern group. This is of practical importance in two ways. First, 
if all those in the high-concern group are selected for intervention and risk-managed, 
then the outcome of concern can be prevented in the very few who would go on to 
commit it without the need to attempt the impossible task of predicting whom they are. 
Second, resources can be refocused on the high-risk group, and the majority of cases 
who will not be found in the high-concern group can be eliminated or subject to less 
intensive interventions. Concern levels are reviewed on a regular basis in operational 
circumstances, and can be used as a measure of change. 


“Red Flag” Indicators 


Not all risk factors have an equal value, and some may be accorded predominance. 
Some risk assessment instruments employ the term “red flag indicators” to designate 
risk factors which, if present, will singly determine that a case ranks as a high risk or 
concern until proven otherwise. For instance, the Stalking Risk Profile (MacKenzie, 
McEwan, Pathe, James, Ogloff, & Mullen, 2009), which is a structured professional 
judgment approach to assessing stalking risk, includes five such items in the assessment 
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of violence: suicidal ideation, homicidal ideation, last resort thinking, high-risk 
psychotic phenomena, and psychopathy. These are essentially psychological parameters 
which, although they may manifest in some observable behavioral change, do not 
necessarily do so. They are most suited to risk assessments where clinical examination of 
the subject of concern can be incorporated. In the Workplace Assessment of Violence 
Risk (WAVR-21;White & Meloy, 2007), another structured professional judgment 
instrument — and one that focuses on discerning a pathway to violence — the first five 
coded items would be considered red flag indicators or “the system blinking red”*: 
motives for violence; homicidal ideas, fantasies or preoccupations; violent intentions or 
expressed threats; weapons skill and access; and pre-attack planning and preparation. 


Likely Severity and Probability of Outcome 


Other concepts that need to be taken into account in assessing risk of violence are those 
of severity of outcome and probability. Severity of outcome, in other words “the 
stakes,” does not predict whether or not the act will occur, but often influences the 
extent of the response given the predicted severity of the act. For example, information 
that a subject of concern both possesses and has the skill to use firearms may establish 
“the stakes” as severe injury or death. The probability of a terrorist incident, where 
high severity would equate with multiple fatalities, a major loss of faith in security 
services and damage to international reputation, often compels a rapid and 
comprehensive response that may be viewed as onerous by the public if the incident 
is successfully thwarted and minimized after the fact. Security assessments generally 
cross-reference severity against assessment of probability, which incorporates levels 
ranging from high or imminent, where there is definite intelligence of a group in the 
late stages of planning a specific attack, to low where there is no evidence of any group 
with the intent or capability to mount an attack. 


Imminence 


Imminence of the behavior of concern, although it is explicitly a prediction of the 
brevity of time between the assessment and the act, also infers an increasing probability 
of the act occurring within a specific time-frame. As such, it is a further variable which 
may influence both concern level and, within a given concern level, necessary speed of 
interventional response. High concern status may be accorded to a case involving risk 
of moderately harmful, but imminent behavior, and to a case involving non-imminent 
risk of the most serious harm. Imminence, as with many other components of risk, 
need not be static, and this points to the fact that level of risk or level of concern may 
change with time. Risk is a dynamic process and it is necessary to repeat the 
consideration of risk factors (the “threat assessment”) in the light of new information, 
as each occasion that risk is considered constitutes simply a “snapshot” of a moving 
scene — a still frame from a movie. 





2 This phrase was attributed to CIA Director George Tenet in the summer of 2001, prior to the 9/11 
terrorist attacks on the World Trade Center and the Pentagon. It appeared to have been a statement of 
imminency by an individual privy to all the intelligence being gathered by various agencies at the time 
concerning a planned terrorist attack on the U.S. (Woodward, 2006). 
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Some risk assessment instruments try to adapt such snapshots to the changing 
picture by the use of scenarios or scenario planning (Hart, Kropp, Laws, Klaver, 
Logan, & Watt, 2003). This involves constructing likely narratives of how things might 
change for the better or worse. In other words, an attempt is made to project the risk 
factors into the future and look at ways in which they might evolve, if certain changes in 
the situation were to occur. 


WARNING BEHAVIORS 


Threat assessment can be supplemented by the use of an additional concept to add 
further perspective, specifically to patterns of change in risk over time. The present 
authors adopted the term “warning behaviors” specifically to indicate factors which 
constitute change, and which are evidence of increasing or accelerating risk. The 
warning behaviors model is not a classification of risk factors, but a useful means of 
conceptualizing behavioral patterns’ indicating increasing threat. Warning behaviors 
constitute particularly toxic changes in patterns of behavior which require an 
operational response. Such patterns may contain individual and dynamic risk factors, 
but are not simply risk factors in themselves. All warning behaviors are subject to 
observational monitoring if intelligence gathering is sufficient. 

The term warning behaviors is not new to the threat assessment literature; what is 
new is a clear definition and typology. Warning behaviors as indicators of increasing or 
accelerating risk of violence are defined and categorized in a typology which presents 
them in an organized and comprehensive manner and points to their individual 
significance. 

Warning behaviors contain within them dynamic rather than static variables, the 
former making substantial, and often more accurate contributions to assessments 
of acute and short-term violence risk (Gray, Snowden, & MacCulloch, 2004; 
McNiel, Gregory, & Lam, 2003; Nicholls, Brink, Desmarais, Webster, & Martin, 
2006; Skeem & Mulvey, 2001). Acute, fast-changing, or accelerating risk is 
typically the domain of threat assessors who are attempting to operationally manage 
very low-frequency, but intentional acts of violence directed toward a specific 
individual or target (Calhoun & Weston, 2003). Although threat assessment was 
developed as an idiographic approach to overcome this low-base-rate problem by 
emphasizing risk management rather than prediction, and the lack of applicability 
of more traditional nomothetic (in the purest sense, actuarial) models for 
predicting general violence among large groups of individuals (Borum et al., 
1999), warning behaviors as single or multiple accelerating actions may be relevant 
to both idiographic and nomothetic approaches. 





3 The use of the term “patterns” emphasizes the nonlinearity of risk assessment. For example, in another 
applied science such as oceanography, a linear approach would suggest that high winds make for high waves. 
The nonlinear approach indicates that intermittent winds will build resonance (transferred energy) within 
waves over time, leading to the risk of a huge rogue wave in the absence of a high wind (Casey, 2010). A 
corollary example from the threat assessment literature would be a paranoid individual predisposed to 
committing a mass murder due to the perceived humiliations by others over a course of years; and then one 
precipitating event, such as his job termination, leads him to actually commit a civilian massacre at his 
workplace (Hempel, Meloy, & Richards, 1999; Meloy et al., 2004a; Mullen, 2004). 


Copyright © 2011 John Wiley & Sons, Ltd. Behav. Sci. Law 30: 256-279 (2012) 
DOT: 10.1002/bsl 


Warning behaviors in threat assessment 261 


PREVIOUS RESEARCH RELATED TO WARNING 
BEHAVIORS 


In the following, elements are traced in previous research in different domains of 
targeted or intended violence which are subsumed within the warning behaviors 
concept as defined above and elaborated below. 


Public Targets 


Emerging research supports the belief that warning behaviors are important in 
problematic approaches toward public figures, and should be construed as much 
broader than a specific threat (Meloy et al., 2010; Scalora et al., 2002a, 2002b, 2003). 
Warning behaviors show an intensity of effort to further a particular quest, usually 
some highly personal cause, but they could include a fixation on a public individual. 
They often predict an approach (Meloy et al., 2010), but with some exceptions 
(Scalora et al., 2003). Intensity has been measured in frequency of contact, duration of 
contact, multiple means of contact, and multiple contacts with other public figures 
(target dispersion; Scalora et al., 2002a), and is also associated with the presence of 
serious mental disorder in the public figure approach research (James et al., 2009; 
Scalora et al., 2002b). 

Warning behaviors are also present in the public figure attack research. In 
contemporary western European attacks upon politicians (James et al., 2007), 46% of 
the subjects evidenced warning behaviors before attacking,* and were more likely to 
have a mental disorder (phi=0.77 effect size), to be psychotic at the time (0.65), and to 
show clear evidence of delusional beliefs (0.65) at the time of the attack. In the 
Exceptional Case Study Project (ECSP) conducted by the U.S. Secret Service 
(Fein & Vossekuil, 1998, 1999) — despite the very low frequency of directly 
communicated threats toward the target or law enforcement (7%) — the majority of 
the subjects had a history of verbal or written communication about the target 
(77%), one out of four communicated to the target (23%), and 63% had a history of 
indirect, conditional, or direct threats about the target. According to Dietz & Martell 
(2010, p. 344), 


every instance of an attack on a public figure by a lone stranger in the United States for which 
adequate information has been made publicly available has been the work of a mentally 
disordered person who issued one or more pre-attack signals in the form of inappropriate 
letters, visits or statements. 


Specific warning behaviors may be another moderating variable between the public 
figure problematic approach and the attack research (Meloy, 2011); but there are, as 
yet, no empirical studies which have assessed the relationship between certain warning 
behaviors and subsequent intended violence. There are many case studies, however, 
which retrospectively identify certain warning behaviors after an attack as predictors of 
that attack, but such circular reasoning does not advance predictive science; it would 





* In the European study, warning behaviors included posters, newspaper advertisements, attempted lawsuits 
against the government, chaotic deluded letters to politicians and the police, threatening letters, leafleting the 
public, telling friends of the intent to attack, and, in one case, attempted self-immolation in front of the 
eventual victim’s place of work. 
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be most useful to determine both the specificity (true negatives) and sensitivity (true 
positives) of certain warning behaviors in relation to a public figure attack, a task easier 
said than done. However, the first difficulty with warning behaviors is a lack of clarity 
in definition, which in turn hampers measurement. 


Psychiatric Patients 


Monahan and colleagues (2001) provided important data relevant to warning behaviors in 
their MacArthur study ofa large sample (N= 939) of acute psychiatric patients discharged 
to the community who were subsequently violent toward others. Despite the fact that they 
focused upon general violence risk rather than targeted violence, within their main effects 
logistic regression model and iterative classification tree were several clinical risk factors 
that resonate with certain warning behaviors in the targeted violence literature: violent 
fantasies (single target focus), violent fantasies (escalating seriousness), violent fantasies 
(target present), threats at admission, and grandiose delusions.’ Grandiosity in another 
study of public figure approachers, for example, was found to be the single best predictor 
of a problematic approach toward a member of the British Royal Family (James et al., 
2010a), and in an earlier study, significantly differentiated those who approached US 
celebrities from those who did not (Dietz & Martell, 1989). All five of the MacArthur 
variables were assessed by clinicians through observation or structured clinical interview, 
but could be inferred through overt behavior in a more naturalistic environment and 
indirectly measured in a threat assessment context. 


Adolescent Mass Murderers and School Shooters 


Among adolescent mass murderers, warning behaviors in the form of leakage and 
directly communicated threats appear to be quite frequent. Meloy, Hempel, 
Mohandie, Shiva, & Gray (2001) found that 58% of their adolescent subjects (W=34) 
made threatening statements concerning their mass murder beforehand, usually to third 
parties. However, the majority of adolescent mass murderers also threatened their targets. 
Examples of direct threats included, “Tomorrow you find out if you live or die.” An 
example of leakage included the statement, “Wouldn’t it be fun to kill all those jocks?” 
(Meloy et al., 2001, 2004a). This was very similar to other research on adolescents. 
O’Toole (2000) found among a sample of school shooters in her F.B.I. study that all 
subjects demonstrated some type of what the present authors term warning behavior 
before the shooting. The F.B.I. study included a wide range of both direct and indirect 
forecasting behaviors underpinned by different and/or multiple motivations. These 
included leakage, and ranged from subtle threats to innuendos to diary entries, doodling 
or videotapes. The recurring themes were violence, hopelessness, despair, hatred, 
isolation, loneliness, nihilism, or an “end of the world” philosophy. Another type of 
warning behavior in the F.B.I. study comprised attempts by the subject to persuade 
unwitting or knowledgeable family members, friends, or others to help with preparations 
for the violent act. 





> All five of these variables were significant p< 0.05, and three of these variables produced odds ratios > 1.8; 
however, some of these five variables, such as delusions, do not have an independent relationship with 
violence outside a logistic regression or iterative classification model, illustrating “the difficulty of identifying 
main effect or univariate predictors of violence” (Monahan et al., 2001, p. 90). Violent fantasies did have an 
independent relationship with violence risk, especially if the patients continued to report such thoughts. 
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The U.S. Secret Service (Vossekuil et al., 2000) used the term “signaling the attack” 
behaviors to designate what the present authors would term warning behaviors in their 
study of school shooters. In 81% of their cases (1=37) at least one person knew the 
shooter was thinking about or planning the incident, and in 59% of the cases, more 
than one person knew about the planning. In 93% of the cases, the attackers 
engaged in some pre-offense “disturbing” behavior that created concern in those 
around him. These behaviors ranged from actions directly related to the impending 
incident, such as accessing a firearm — what we call a “pathway” warning behavior 
(see below) — to writing a poem or essay containing homicidal and/or suicidal 
themes — what we call a “fixation” or “identification” warning behavior, depending 
on the details of the writing. There was subject overlap in the F.B.I. and U.S. 
Secret Service studies, and they should not be treated as independent samples. A 
similar pattern of warning behaviors was found in a small sample of seven German 
school shooters (Hoffmann, Roshdi, & Robertz, 2009). All of the incidents were 
planned at least days, but more often weeks, months or even years before the 
attack. Warning behaviors were present, such as suicidal ideation (57%), displaying 
a weapon or threatening another person with a weapon before the attack (86%), 
fascination with other school shooters or violent offenders (86%), and leaking their 
intent to other individuals, usually peers (100%). 


Adult Mass Murderers 


Among adult mass murderers, defined as subjects 18 years of age or older who 
killed at least three people in one incident, the majority appear to leak their intent 
to third parties before they attack — one type of warning behavior. Hempel and 
colleagues (1999) found that 67% of a sample of 30 mass murderers, a non-random 
sample of convenience, engaged in leakage. Half of these individuals made a 
specific threat verbally or in writing, which described the location, victims, or time 
of the killings. The other half made either a generalized threat (no location or 
victim pool identified) or a mixed threat (generalized threat combined with a 
specific threat). An example of a generalized threat would be “I’m going hunting” 
(the words of James Huberty, referenced in Hempel et al., 1999). An example of a 
specific threat would be a suicide note that described the massacre in detail. Again, 
the contrast with the low frequency of directly communicated threats in this study is 
notable: 20% of the non-psychotic mass murderers directly threatened their target 
beforehand, and none of the psychotic mass murderers, who also had the highest 
lethality rate, directly threatened their target beforehand. 


Spousal Homicide Perpetrators 


Some incidents of spousal homicide indicate a predatory mode of violence (planned, 
purposeful, emotionless), while most are affective (reactive, impulsive, intense 
emotional arousal) (Meloy, 2006). The concepts of targeted violence and warning 
behaviors will most likely apply to those with a history of predation toward their 
spouses. Research suggests a number of risk markers for spousal homicides (Campbell, 
2004; Campbell et al., 2003; Campbell, Glass, Sharps, Laughon, & Bloom, 2007; 
Echeburua, Fernandez-Montalvo, de Corral, & Lopez-Goni, 2009). Warning behaviors 
(see later) among these risk factors from the Danger Assessment (Campbell, 2004) 
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would include an increase in severity or frequency of violence (item 1 on the Danger 
Assessment; energy burst warning behavior), ownership of a gun (item 2; identifica- 
tion), direct threat with a weapon (item 5; directly communicated threat), direct threat 
to kill Gtem 6; directly communicated threat), forced sex (item 9; novel aggression), 
choking (item 10; novel aggression), control of daily activities (item 13; fixation), 
jealousy (item 14; fixation), beating while pregnant (tem 15; novel aggression), 
threatening or attempting suicide (item 16; last resort), threats to harm children (item 
17; directly communicated threat), and stalking Gtem 19; pathway). For spousal 
homicides, threat assessment and the utilization of warning behaviors described in the 
Danger Assessment (Campbell, 2004) would be most applicable to the generally 
violent/antisocial and dysphoric/borderline types of batterers (Dixon, Hamilton- 
Giachritsis, & Browne, 2008). The overcontrolled/catathymic spouse killer is different 
in his pattern of warning behaviors, and focused research on this is needed. 


Workplace Violence Attackers 


Although the prevention of workplace violence is a common field of practical threat 
assessment, surprisingly little systematic research has been done on warning behaviors 
preceding acts of targeted or intended violence in a workplace setting. Southerland, 
Collins and Scarborough (1997) analyzed media reports from the USA where 
employees, former employees, or spouses conducted lethal workplace attacks. They 
found that 27% of the offenders (N=282) had previously threatened violence in the 
workplace. A research report regarding 15 workplace homicides by current or former 
U.S. Postal employees (The National Center on Addiction and Substance Abuse at 
Columbia University, 2000) found that 14 of 15 offenders had troubled histories, 
including substance abuse, past violence, mental health problems, and/or criminal 
histories, and three perpetrators had been terminated for threatening behavior at the 
workplace before the attack occurred — although there was no control group in this 
study. Only the latter factor would be considered a warning behavior, although the 
others would be considered status predictors of general violence risk. In a German study 
based on court and police files, Hoffmann and Délitzsch (2006) detected a variety of 
warning behaviors in a group of 20 lethal or near-lethal workplace attacks. Crimes 
committed by strangers were excluded from the sample. Most of the perpetrators (90%) 
planned and prepared their attack beforehand, such as illegally obtaining a gun (30%), 
constructing explosives (10%), or starting surveillance of the residence of the targeted 
victim (10%) — all pathway warning behaviors. Seven offenders displayed final-act 
behaviors (35%), such as ensuring the financial well-being of their families or sending 
farewell letters to friends — an aspect of last resort or energy burst warning behavior. 
Final acts can also occur when people plan to commit suicide (Calhoun & Weston, 
2003). A majority of the workplace violence offenders (60%) either directly threatened 
the victim or communicated to third parties their violent intent — what the present 
authors term directly communicated threat and leakage warning behaviors. 


Federal Judicial Threateners and Attackers 


Calhoun (1998) studied 3,096 inappropriate communications to federal judicial 
officials in the U.S. between 1980 and 1993. No subsequent violence occurred in 90% 
of the cases where there was a threatening or inappropriate communication to a judge. 
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In 3.9% of the cases violence resulted, and in another 4.1% the threat was enhanced with 
efforts to carry it out, but no violence resulted. Suspicious activity as a form of threat — such 
as presence in or around the courthouse at odd hours — was 40 times more likely to result in 
violence than threatening or inappropriate communications through writing, telephoning, 
verbalization, or a third party informant. 


A TYPOLOGY OF WARNING BEHAVIORS 


The typology delineates factors that are indicative of increasing or accelerating risk of 
targeted violence. It was constructed by identifying and contemplating patterns of data 
and theoretical formulations across the entire writing and research on targeted and 
intended violence, discussions with colleagues who do threat assessment, and the 
casework experience of the authors over the past several decades. It is a rationally 
derived typology that will need to be empirically tested. The proposed eight warning 
behaviors for threat assessors are as follows: 


1. Pathway warning behavior — any behavior that is part of research, planning, 
preparation, or implementation of an attack (Calhoun & Weston, 2003; Fein & 
Vossekuil, 1998, 1999). 

2. Fixation warning behavior — any behavior that indicates an increasingly patholog- 
ical preoccupation with a person or a cause (Mullen et al., 2009). It is measured by: 
(a) increasing perseveration on the person or cause; (b) increasingly strident opinion; 
(c) increasingly negative characterization of the object of fixation; (d) impact on the 
family or other associates of the object of fixation, if present and aware; (e) angry 
emotional undertone. It is typically accompanied by social or occupational 
deterioration. 

3. Identification warning behavior — any behavior that indicates a psychological desire to 
be a “pseudo-commando” (Dietz, 1986; Knoll, 2010), have a “warrior mentality,” 
(Hempel et al., 1999), closely associate with weapons or other military or law 
enforcement paraphernalia, identify with previous attackers or assassins, or identify 
oneself as an agent to advance a particular cause or belief system. 

4. Novel aggression warning behavior — an act of violence which appears unrelated to any 
targeted violence pathway warning behavior which is committed for the first time. 
Such behaviors may be utilized to test the ability (de Becker, 1997) of the subject to 
actually do a violent act, and may be a measure of response tendency, the motivation 
to act on the environment (Hull, 1952), or a behavioral tryout (MacCulloch, Snowden, 
Wood, & Mills, 1983). When homicide occurs within this warning behavior, it may be 
“proof of kill” (G. Deisinger, personal communication, February, 2011). 

5. Energy burst warning behavior — an increase in the frequency or variety of any noted 
activities related to the target, even if the activities themselves are relatively 
innocuous, usually in the days or weeks before the attack (Odgers et al., 2009). 

6. Leakage warning behavior — the communication to a third party of an intent to do 
harm to a target through an attack (Meloy & O’Toole, 2011). 

7. Last resort warning behavior — evidence of a violent “action imperative” (Mohandie & 
Duffy, 1999), increasing desperation or distress through declaration in word or 
deed, forcing the individual into a position of last resort. There is no alternative 
other than violence, and the consequences are justified (de Becker, 1997). The 
subject feels trapped (S. White, personal communication, October, 2010). 
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8. Directly communicated threat warning behavior — the communication of a direct threat 
to the target or law enforcement beforehand. A threat is a written or oral 
communication that implicitly or explicitly states a wish or intent to damage, injure, 
or kill the target, or individuals symbolically or actually associated with the target. 


These eight types of warning behaviors are not conceptually equivalent (L. Preston, 
personal communication, March, 2010), in that fixation and identification both 
describe psychological constructs inferred through behavior, similar to what Nock and 
colleagues (2010) referred to as “implicit cognitions,” while novel aggression and 
energy burst describe overt behaviors without any inference as to motivation. 
Moreover, there is some potential overlap among types, such as pathway behavior 
and energy burst behavior. Nevertheless, this typology has face validity, embraces 
within its categories most of the universe of warning behaviors in intended and targeted 
violence, and may provide a useful beginning structure for further operational thinking 
and research. 


CASE EXAMPLES 


The typology is a synthetic theoretical formulation, constructed through the consideration 
of empirical case studies and group studies with substantial sample sizes of those who 
completed an act of targeted violence (Calhoun, 1998; Dietz & Martell, 1989; Fein & 
Vossekuil, 1998, 1999; Hoffmann, Meloy, Guldimann, & Ermer, 2011; James et al., 2007, 
2008; Meloy, 2011; Meloy et al., 2004a, 2004b). The following cases are selected on the 
basis of their illustrative nature, and are intentionally taken from different domains of 
targeted violence to underscore that the various types of warning behaviors are relevant to 
each such domain. All cases are retrospective in nature with the corollary risks of hindsight 
bias, confirmatory bias, and over-determination of the importance of warning behaviors. 


Pathway Warning Behavior 


On September 6, 1901, U.S. President William McKinley attended the Pan American 
Exposition in Buffalo, New York. Leon Czolgosz, an avowed anarchist and follower of 
Emma Goldman, was in Chicago on August 29, and traveled to Buffalo by train. He 
intended to shoot the President but had not yet devised a plan. Once in Buffalo, he 
rented a room at a local bar and hotel owned by a Polish American. He stated that 
he went to the Exposition a couple of times a day. It was not until September 3, however, 
that he firmly decided to make the attempt on the President. It was on this day that he 
purchased a .32 caliber revolver and ammunition. That evening, Czolgosz went to the 
Exposition grounds near the railroad gate where McKinley was due to arrive that day. 
McKinley exited the train and entered the grounds, but Czolgosz stated that he was 
afraid to attempt that day due to the number of bodyguards, and he feared that he 
would be discovered and fail. He then returned to the Exposition on September 4 and 
was able to stand near McKinley during a Presidential speech. He again decided not to 
make the attempt because the crowd was large and he was being frequently jostled, 
which could have thrown off his aim. Czolgosz waited until Thursday, September 5, 
but could not get close enough for a clear shot. So he returned on the morning of 
September 6 to the Exposition grounds. “Emma Goldman’s speech was still burning me 
up. I waited near the central entrance for the President, who was to board his special train 
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from that gate... I stayed on the grounds all day waiting” (Buffalo Evening News, 
September 7, 1901, p. 9). Czolgosz then conceived the idea of wrapping his handkerchief 
around his revolver in his hand so that he could bring the weapon to bear quickly. He 
went to the Temple of Music, where a final reception for McKinley was to be held before 
his departure. Czolgosz stood in line and waited his turn. “I got in line and trembled and 
trembled, until I got right up to him, and then I shot him twice through my white 
handkerchief. I would have fired more, but I was stunned by a blow in the face, a frightful 
blow that knocked me down” (Buffalo Evening News, September 7, 1901, p. 9). U.S. 
Secret Service Agents immediately jumped on him, but McKinley had been wounded in 
the chest and abdomen. The President died 8days later (Biesterfeld & Meloy, 2008; 
MacDonald, 1902; McClure & Morris, 2004). 

This case illustrates the dynamic movement along a pathway to violence and the 
final markers — planning, preparation, and implementation of an attack — along such a 
pathway (Calhoun & Weston, 2003; Fein & Vossekuil, 1998, 1999). 


Fixation Warning Behavior 


Stephen Wynn was concerned and frightened in the spring of 2001, more than he 
had ever been since his adolescent daughter was kidnapped over a decade ago — and 
subsequently recovered after payment of a $1.45 million ransom. Wynn was a 
multi-billionaire, a corporate executive and celebrity figure, who had almost 
singlehandedly rebuilt Las Vegas into a thriving world-class entertainment empire. 
But over the past year, a man who called himself Don Vici, a.k.a. Donald Eugene 
Phillips, was sending him dozens of letters, stating that Wynn was his half-brother 
and demanding payment of $50 million dollars. Phillips was on the move, had been 
in Las Vegas early in his pursuit, and now was somewhere on the U.S. west coast. 
The letters were increasingly angry and devaluing, and the most frightening events 
had just occurred. Someone delivered flowers to his home for his wife, Elaine, and 
they appeared to be from Phillips. And on March 31, 2001, Wynn’s security 
received multiple telephone calls on their answering service, among them: “I just 
lost my ass tonight and I’m sick and I’m dying, and I ain’t gonna fucking die 
alone.” And then, “I’m gonna kill him with me.” 

His security had not contacted the local police, but subsequent to this homicidal 
threat, both the Las Vegas Metropolitan Police Department and the F.B.I. were 
brought into the case. Phillips was subsequently arrested in Florida, extradited to 
Nevada, and tried for aggravated stalking. He pled legal insanity. On evaluation, he 
was found to be a habitual con man with some violence in his history (PCL-R=35), 
psychiatrically impaired (bipolar disorder), and medically in trouble (HIV and 
hepatitis A and B positive). Phillips was judged to be legally sane and an imposter 
(Deutsch, 1953) — a man who consciously pretends to be someone he is not to 
manipulate others — by the jury, and since this was a third strike felony, was 
eventually sentenced to life in prison (Meloy & Mohandie, 2008). His primary 
motive appeared to be monetary gain, but emotionally driven by his envy of 
Stephen Wynn. He had written in one of his letters, “While I sit here and watch the 
Country Music Awards in my little fucking dump, I think of your rich fucking ass 
sitting there in your fucking palace and I envy the hell out of your blood. You just 
don’t know man” (J.R.M.’s case files in State v. Donald Eugene Phillips; Meloy & 
Mohandie, 2008). 
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This case illustrates fixation warning behavior through an increasingly pathological 
preoccupation with Wynn (frequency and duration of communications), the increasingly 
angry and devaluing tone, and the incessant demands for money. 


Identification Warning Behavior 


Timothy McVeigh bombed the Murrah Federal Building in Oklahoma City on April 
19, 1995. He killed 168 people by detonating a 4,000-pound fertilizer bomb which he 
and Terry Nichols had constructed inside a Ryder truck the day before. The widely 
understood motivation for this bombing was McVeigh’s fury toward the burning of the 
Branch Davidian compound in Waco, Texas, exactly two years before. McVeigh 
attributed this conflagration to the intentional acts of the Bureau of Alcohol, Tobacco, 
Firearms and Explosives and the F.B.I. (Michel & Herbeck, 2001). 

His motivation, however, ran much deeper. Once he had failed the selection process 
for the U.S. Army Special Forces, and subsequently left military service, McVeigh 
became socially adrift and gravitated toward the Patriot Movement, a right wing anti- 
government, anti-Semitic assemblage of true believers who saw a conspiracy of the 
Zionist Operated Government (ZOG) at every turn. McVeigh had become a soldier 
without an army, developed a quite rigid and disciplined “warrior mentality” while in 
the military which was consonant with his own personality structure, and continued to 
collect military paraphernalia, including weapons, as well as peddling such materials at 
gun shows throughout the midwest and southwest U.S. He harbored a fantasy of 
wanting to be the “ultimate warrior,” articulated in his written communications to his 
sister Jennifer; but most relevant, and as his fantasy coalesced into a bombing 
conspiracy, he believed he would be the first hero of the second American Revolution, 
a war that would be ushered in by his planned bombing. The date selected would not 
only coincide with Waco, but also the battle of Lexington-Concord, MA, on April 19, 
1775, when the first shots of the American Revolution were exchanged between 
farmers and the British military. Evidence supporting this identification warning 
behavior came in five forms: (a) during the bombing he wore a T-shirt inscribed with 
the words of Thomas Jefferson: “The tree of liberty must be refreshed from time to 
time with the blood of patriots and tyrants;” (b) he had within his yellow Mercury 
Marquis a large assortment of Patriot Movement literature referring to this important 
event; (c) he communicated his desire to be the “first hero” to his sister in writing; (d) 
he carried with him in his pocket a commemorative coin for the Battle of Lexington- 
Concord, inscribed with the words of the American poet Ralph Waldo Emerson, “The 
shot heard round the world;” and (e) he readily identified with the hero of William 
Pierce’s book, The Turner Diaries, which also provided a template for his act of 
terrorism (Meloy, 2004; J.R.M.’s case files in U.S. v. Timothy fames McVeigh). None 
of these behaviors advanced the preparation for the bombing, but they all contributed 
to his motivation for the bombing, which was a violent and grandiose narcissistic 
identification as an American war hero. 


Novel Aggression Warning Behavior 
On November 20, 2006, former student Bastian B. entered the junior high school in 
Emsdetten in the western part of Germany. The 18-year-old was wearing a black 


trench coat and was armed with pipe bombs and muzzle-loading rifles. He immediately 
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started shooting at teachers, students, and the janitor, injuring five of them. Police 
arrived shortly after the beginning of the shooting and entered the building. Feeling 
trapped, Bastian B. then committed suicide with one of his guns. Due to police intervention 
he was not able to detonate his explosives. 

Bastian B. had identified himself with the U.S. school shooters in the 1999 
Columbine attack, and had dreamt of committing a mass murder with a higher 
number of casualties than his role models (identification warning behavior). Two and a 
half years before the attack he had communicated in an internet forum that he was 
desperate and thought about starting a massacre (leakage warning behavior). Bastian 
B. was well known for his fascination with weapons and the military (identification 
warning behavior). In 2005 he proudly established a local Airsoft association with 20 
members, calling themselves TASTE (Tactical Air Soft Team Emsdetten). They 
started training in the woods using replica firearms and wearing military clothes 
(pathway or identification warning behavior). Due to internal conflicts, TASTE 
disbanded in July, 2006. In the same month Bastian B. threatened two men with a tear- 
gas pistol at a local festivity (novel aggression warning behavior). Police were called 
and confiscated the weapon. He said to the policemen he had done this in order to 
settle a dispute. Never before had Bastian B. acted so aggressively in public. In October 
2006 he obtained through the internet the guns he later used for the school shooting. A 
day before the attack, Bastian B. produced a video of himself. He bragged how he had 
frightened the two men and the police with the tear-gas pistol at the festival J.H.’s case 
files). 

This case illustrates a number of warning behaviors, but is utilized as an example of 
novel aggression warning behavior, an act of aggression committed for the first time 
that is unrelated to the eventual targeted violence. It may be a test of the subject’s 
ability to be violent. 


Energy Burst Warning Behavior 


On January 8, 2011, Jared Loughner attempted to assassinate U.S. Congresswoman 
Gabriele Giffords, wounded 12 others, and killed Chief District Federal Judge John Roll 
and five others in a shopping mall outside Tucson, Arizona. The evening before, 
Loughner dropped off a 35mm roll of film at a Walgreen’s drugstore to be developed, 
and then checked into Motel 6 shortly after midnight. At 0219 he picked up the photos 
and made another purchase at Walgreen’s. He then left a telephone message with a 
friend. At 0412 he posted to his MySpace page a photo of a Glock 19 and the words, 
“Goodbye friends....” He also conducted web searches intermittently through the 
night on “assassins” and “lethal injection.” Just after 0600, he visited a Walmart and a 
Circle K store. He left the first Walmart where he did not complete a purchase because 
the clerk was concerned about his behavior, went to a second, and purchased 9mm full 
metal jacket ammunition and a black diaper bag at 0727. Shortly thereafter he was 
stopped by an officer for running a red light. He went home where his father 
confronted him about the contents of the bag, and Loughner ran away from him. He 
returned to the Circle K where a cab picked him up and took him to a Safeway 
supermarket where he insisted on obtaining change so he did not overtip the driver. 
Sixteen minutes later he began his rampage at 1010. 

The other photos Loughner had picked up contained images of him in a red G 
string holding the Glock next to his crotch, and then next to his buttocks while looking 
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in a mirror. He came to the mass murder with a 31-round, fully loaded magazine, two 
15 round magazines in his pocket, and a buck knife, with his money, driver’s license, 
and credit card in a plastic bag (Lacey, Becker, & Dolnick, 2011). 

This case illustrates energy burst warning behavior in a period of 12 hours before the 
mass murder in that behavioral activity significantly and noticeably increased in 
relationship to the intended violence. Pathway (preparation and implementation of 
targeted violence) and identification (researching other assassins) warning behaviors are 
also evident1 


Leakage Warning Behavior 


A number of examples of leakage can be found in Meloy & O’Toole (2011). The 
following is an unusual case of leakage involving the internet. 

On April 20, 2010, the website “Revolution Muslim” posted the following internet 
statement directed toward Trey Parker and Matt Stone, the co-creators of the cartoon 
series, South Park: “We have to warn Matt and Trey that what they are doing is stupid 
and they will probably wind up like Theo van Gogh for airing this show. This is not a 
threat, but a warning of the reality that will likely happen to them.” The statement was 
in response to their portrayal of the Prophet Muhammad in a bear suit, along with 
cartoon characters of Jesus, Buddha, and Moses in several episodes of the program a 
week earlier. Although not a direct threat, and carefully written as a “warning” to the 
co-creators that they would likely be killed by others for their sacrilege, the import of 
the statement was accentuated by photos of Theo Van Gogh’s corpse in an 
Amsterdam street on November 2, 2004 following his assassination by Mohammed 
Bouyeri, a member of the Islamist Hofstad Group, which was planning and 
preparing to target members of the Dutch Parliament as well as Schiphol Airport 
and a nuclear reactor. The home and work addresses of the co-creators were also 
listed on the website, along with a sermon by a wanted Yemeni cleric outlining the 
punishments for blasphemy against the Muslim religion. The leakage to a third 
party, in this case, the entire internet, of intent to do harm to the writers, received 
an extraordinary publicity boost when it was widely covered by CNN on all their 
platforms that same evening, which focused upon the fear-driven stifling of free 
speech protected by the First Amendment of the U.S. Constitution (J.R.M.’s case 
files; cnn.com, April 20, 2010; Buruma, 2006). 

This case illustrates leakage warning behavior in that a threat explicitly directed at 
the targets was not conveyed, but done under the guise of a general warning of intent 
that many other third parties could see on the internet. 


Last Resort Warning Behavior 


Friedrich Leibacher was wearing a dark blue jacket bearing the word “police” when he 
approached the parliament in Zug, Switzerland, on September 27, 2001 at 1030. 
Bystanders later claimed that, as he entered the building, he declared that it was a “police 
operation” and stated: “I’ll show them”. He was carrying a rifle, a shotgun, a pistol (all 
legally obtained, one of them nine days before the attack) and a plastic canister with 
propellant. Within two minutes and 34 seconds, he killed 14 people and injured 15 
others. He killed himself at approximately 1034 at the desk of the president of the 
parliament (Nyffeler & Schwyter, 2003). Towards the end of the attack he revealed his 
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identity and shouted: “...now, we deal with ‘the complaint Leibacher’” (Weilbach, 
2009, p. 164). 

Friedrich Leibacher was involved in a three-year-long argument with public 
authorities after he threatened a bus driver with a gun in a bar on October 17, 1998 ina 
private argument, and later also accused him of driving under the influence. The bus 
driver and the Zug transport services sued Leibacher for his actions and claims. 
Complaints directed at various public authorities and politicians followed, indicating 
that Leibacher thought of himself as a “victim of the Zug mafia.” During his 
“struggle,” he had to endure numerous rejections (e.g., refusal of compensation) and a 
lack of response to his demands and his complaints, which resulted in his adopting a 
more aggressive style of writing. He also informed organizations such as Amnesty 
International and the European Court of Human Rights about the “torture” he was 
obliged to endure and begged for help from outside Switzerland. He claimed that the 
legal struggle had left him vulnerable to heart and stomach ailments, which he 
described in a letter to Amnesty International (Weilbach, 2009). 

It is believed by the authorities that he was sitting in the audience when Zug 
politicians, unanimously and without discussion, rejected his complaint against them 
and others in May, 2001. He virtually ceased to write new letters to them after this 
latest rejection and began to focus his attention on gaining “justice” and recognition 
through means other than the legal system. In the end, he did not even bother to open 
the notification of the court’s verdicts sent to him a few days before the attack. In a 
letter to his daughter’s school director written on the evening before the attack, 
curiously in stilted English, he stated: “I am persecuted by the Swiss government for 
some critics... If these things are driving out of control, it is because I am completely 
tired to fight against that supremacy. I am forced to do the same as they do” (Weilbach, 
2009, pp. 162-163). 

While he had made some preparations for an escape (e.g., a rented motor scooter), 
the overall evidence suggests that he did not believe that he would survive. He sold his 
home in March, 2001, closed his bank accounts, and sold his stocks in August and 
September, 2001. In addition, he made a will on August 21, 2001, and 2 days before 
the attack, he telephoned a funeral director and arranged his cremation in the case of 
his death: “My ashes are to be scattered over the Atlantic Ocean” (Nyffeler & 
Schwyter, 2003, p.11). On the day before the attack, he sent a farewell letter to his 
mother who did not read it until two days after the attack. On the day of the attack, he 
sent his lawyer the key to a locker, in which the police later found nine folders 
containing material relevant to his case. During the attack, he was carrying a statement 
on a cord around his neck to the effect that he declined any form of medical attention. 
The police found a declaration entitled “Day of Rage” in his car outside the 
parliament, in which he explained the reasons for his actions and which he had begun 
writing ten days earlier (Nyffeler & Schwyter, 2003). 

This case illustrates last resort warning behavior, in that his “final acts” (Calhoun & 
Weston, 2003) indicate that violence is justified, there is no other alternative, and he 
believes he is trapped. 


Direct Threat Warning Behavior 


A suicide bomber died and two others were injured when two explosions hit the city 
center of Stockholm, Sweden, on December 11, 2010. A car was detonated on the 


Copyright © 2011 John Wiley & Sons, Ltd. Behav. Sci. Law 30: 256-279 (2012) 
DOT: 10.1002/bsl 


272 J. Reid Meloy et al. 


shopping street of Drottninggatan at 1700, and a few minutes later, a man blew himself 
up with a pipe bomb approximately 200 meters from the demolished car. 

The Swedish news agency Tidningarnas Telegrambyra (TT) and the Swedish 
Security Police received an e-mail moments before the bombings which contained 
recorded audio messages in Swedish, English, and Arabic: “Now, your children — 
daughters and sisters — will die like our brothers and sisters and children are dying. .. our 
actions will speak for themselves. As long as you do not end your war against Islam and 
the insult against the prophet and your stupid support for that pig Vilks.” This latter 
comment was in reference to general Swedish acceptance of cartoons of the Prophet 
Muhammad drawn by the artist Lars Vilks in 2007. The message also demanded that 
Muslims in Sweden “Stop sucking up and degrading yourselves,” and was a call to arms: 
“All mujahedeen... now it’s time to attack. Do not wait any longer. Come forth with 
whatever you have, even if it is a knife, and I know that you can bring more than knives. 
Fear no one. Do not be afraid of jail. Do not fear death” (Anderson & Burns, 2010). 

Curiously, he also apologized to his wife and children: “I love you all. Please forgive 
me if I lied to you. It wasn’t very easy to live the last four years with the secret of being 
mujahid, or as you call it terrorist. Please do know one thing, you and the children are 
the best of what happened to me in this life.” 

The following day, an al Qaeda affiliated group, The Islamic State of Iraq, praised the 
“martyrdom operation” of the suicide bomber, Taimour al-Abdaly, called for the blessing 
of Allah, but did not claim responsibility for the attack. Al-Abdaly was a 28-year-old 
Iraqi Sunni who emigrated to Sweden at the age of 10 and spent some of the previous 
decade living in Britain and attending university (Burns & Somaiya, 2010). 

This case illustrates directly communicated threat warning behavior, in that there is 
clear evidence that audio recordings in multiple languages were sent to media outlets 
just before the bombings to warn the intended victims of the attack, and the reasons for 
the violence. 


WHY WARNING BEHAVIORS? 


One warning behavior may detect ominous change in a subject of concern and indicate 
a need for risk management intervention, rather than relying on the accumulation of 
separate risk factors to attempt to predict intended violence. Warning behaviors appear 
to be both evidence of psychological preoccupation and movement toward achieving 
resolution through impending action. They may contain elements of modus operandi 
and also psychologically gratify through ritual or symbolism. For example, pathway 
warning behaviors would, in most cases, be driven by tactical necessity or creativity; 
while identification warning behaviors would likely enhance the narcissism of the 
subject through his attempts to be like those he admires (commandos, warriors, 
martyrs, previous assassins, etc.). In the psychoanalytic literature, these are called 
idealizing or twinship identifications and refer to the wish to worship someone else 
(idealizing) or be like someone else (twinship) (Kohut, 1971). 

Warning behaviors may be motivated by fantasies which are conscious, somewhat 
unconscious, or completely outside the awareness of the subject of concern. For 
example, McVeigh’s identification as a soldier of the Patriot Movement was fully 
conscious and articulated in his writings to his sister. On the other hand, energy burst 
behavior may be evident to the subject of concern, but it may be outside his awareness 
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that it has anything to do with the imminence of his targeted violence. Warning behaviors 
typically contain a variety of emotions, such as anger, fear, anxiety, exhilaration, 
excitement, or anticipation; but such emotions are quite dynamic and may change rapidly 
over time due to a variety of internal and external factors, ranging from the underlying 
neurobiology of the subject and his corresponding psychological dynamics, to his current 
situation, his perceived relationship to his target, and the target’s behavior. None of the 
warning behaviors, however, are diagnostic of any particular mental disorder or 
personality disorder, although they may contribute to understanding both mental state 
and intention. 


TARGET SELECTION 


Warning behaviors can be detected and acted upon even when there is no definite 
knowledge of whom the target might be. In the case examples given above, McVeigh 
attacked a building which was representative of government, against whom his main 
grievance lay. Leibacher’s anger was with local government, but also toward some of 
the specific individuals he intended to shoot. Taimour al-Abdaly was attempting mass 
indiscriminate killing, and by definition therefore had no specific target. There are also 
cases where the eventual target was intended but opportunistic (Calhoun & Weston, 
2003), such as in the German cases of the attacks on Lafontaine and Schaeuble (James 
et al., 2007; Hoffmann et al., 2011); the intent in both cases was to bring attention to a 
grievance by attacking a prominent politician. 

There are also cases where the recipient of a warning behavior may be a third party 
and a public figure. In the following example of last resort warning behavior (Cullen, 
1996), the grievance was against an impersonal body, a local council, but the target was 
school children, and a message of last resort was sent, not to the council, but to the 
British Queen as the ultimate legal authority and head of state. In addition, the target 
was a third party which was a symbol of the real target of the grievance, or one that 
would cause major distress to the desired, but unavailable, target: 

Thomas Hamilton was 44 at the time of his death. In 1974, the Scout movement 
had withdrawn his warrant as a scout leader, beginning a festering sense of grievance 
over the next 20years, during which he ran a series of boys’ clubs. The way he ran the 
clubs led to accusations of improper behavior on his part and resulted in his coming 
into contention with a number of local authorities which owned the school premises 
where his clubs met. His summer camps in 1988 and 1991 and a residential sports 
training course in 1992 were investigated by police, but no charges resulted. Hamilton 
countered these events by a campaign of complaints against the local authority and the 
police. He wrote letters of self-justification to parents and tried to enlist the help of his 
MP (Member of Parliament, a political representative in the U.K.). He became fixated 
on his grievance and made persistent complaints over a number of years. In February 
1996, he wrote to Queen Elizabeth for help in restoring his dignity and stated that he 
was doing so as a “last resort.” No action was taken upon receipt of the letter. From the 
report of the subsequent official inquiry, it is clear that ideas as to what he would do if 
all failed were already coalescing in Hamilton’s mind. Three weeks later, he walked 
into the gymnasium of a local primary school and killed 15 children and their teacher. 
Another child was killed in subsequent firing before Hamilton turned the gun upon 
himself. He had been carrying two pistols and two revolvers and 743 rounds of 
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ammunition, of which he fired 109. He had a license for the weapons he owned. 
Following the massacre, the law was changed to ban the possession of hand guns by 
private individuals in the U.K.; the British Olympic pistol shooting team is now obliged 
to leave the British mainland in order to practice. 

A secondary point is that public figures may receive material comprising a warning 
behavior in cases which have nothing to do with them. For instance, a man wrote to the 
British Queen from one of her dominions with the request that she grant him a license 
to kill children. This was taken as a form of leakage warning behavior, and the Fixated 
Threat Assessment Centre (Boyce, 2011; James, Kerrigan, Forfar, Farnham, & 
Preston, 2010b) arranged for the man urgently to be assessed by psychiatric services in 
his home town. He was found to be suffering from the delusion that the 12-year-old 
next door was being serially sexually abused by strangers and he had decided that the 
best way to help her would be to kill her. This example illustrates that those assessing a 
threat to an individual or institution need to be mindful that there will also be a need to 
act when a warning behavior indicates a threat to a member of the general public, 
rather than a public figure. It also emphasizes the point that, in cases of public figure 
harassment and stalking where the perpetrator is psychotic, those at greatest risk of 
violence are not the presumed target, but members of the perpetrator’s family, those in 
his social or occupational circle, or members of the general public (Dietz & Martell, 
1989; James et al., 2010b). This contrasts with the research concerning violence 
among ex-intimate stalkers, most of whom are not mentally ill, where the identified 
target is most at risk (Meloy, 1998, 2002; Mohandie, Meloy, McGowan & Williams, 
2006). 


THE PRACTICAL APPLICATION OF WARNING 
BEHAVIORS IN THREAT ASSESSMENT 


Threat assessment involves the assessment of levels of concern on a subject who has been 
flagged by some aspect of their behavior, and is based upon what (often limited) evidence 
is available at the time. Examples of agencies which operate in this manner in the field of 
public figures are the U.S. Capitol Police Threat Assessment Section (Scalora et al., 
2002a; Schoeneman et al., 2011), the Fixated Threat Assessment Centre (FTAC; James 
et al., 2010a, 2010b) in London and the U.S. Secret Service (Fein & Vossekuil, 1998, 
1999; Phillips, 2008). Warning behaviors in this context are intended to be used as 
indications ofa recent or current significant increase in risk which requires a response. For 
example, the FTAC will place someone in the category of high concern, until or unless 
proof to the contrary can be established, if a warning behavior or a red flag is present; the 
U.S. Secret Service, on the other hand, investigates all cases that come to their attention. 
Warning behaviors are especially useful in the monitoring of risk in known cases, but they 
are equally relevant in cases being assessed de novo. 

Warning behaviors can only constitute warnings if the behaviors are detected, and 
implicit in the description of these behaviors is the need for adequate intelligence 
gathering. This could range from the establishment of trust in a school or campus setting 
between students and their teachers so that behaviors of concern are talked about and 
investigated by a threat assessment team (Deisinger, Randazzo, O’Neill, & Savage, 2008; 
Mohandie, 2000), to formal intelligence-gathering efforts at a local, state, or national level 
that often involve both technological and human assets. Without such intelligence-gathering 
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efforts, however, threat assessment will not work; even when such efforts occur, there is 
always the risk of a “silo effect” — different domains of behavior are never linked together or 
synthesized to develop a comprehensive picture of the subject of concern, conduct further 
investigation, identify other warning behaviors, and actively risk-manage the case. The 
collection of such data is all the more difficult in a naturalistic environment where the 
subject of concern is often freely moving within his community, region, state, nationally, 
or globally; hence the need for a high degree of cooperation between law enforcement, 
intelligence, and security personnel across jurisdictions and interests. National security 
and state secrecy further complicate the data gathering and sharing. Such issues are beyond 
the scope of this article, but clarity of communication and preciseness of terminology are a 
step forward. 


FUTURE DIRECTIONS 


This typology is offered to aid in the development of threat assessment by separating 
and defining the patterns of accelerating or increasing risk in cases where concern for 
intended violence is being investigated. Its purpose is to contribute to the advancement 
of threat assessment from unstructured to structured professional judgment, a more 
reliable and valid method of assessment in violence risk research (Monahan, 2008).° The 
authors offer it to help structure professional judgment among threat assessors, and as a 
complement to other risk assessment instruments which address both dynamic factors and 
change over time. Much further research needs to be done; for example, whether such 
warning behaviors can be reliably identified, coded, and utilized in a valid manner (Skeem 
& Monahan, 2011). There is no predictive validity yet established for this typology, and 
any weighting of these warning behaviors would be dependent upon such research. 
Without prospective empirical data, a typology such as this should not be utilized to 
modify any legal standards of imminency of risk or involuntary civil commitment. One 
recent study (Hoffmann et al., 2011), however, applied this warning behavior typology 
(without last resort warning behavior) to the small universe of non-terrorist public figure 
attackers in Germany during the latter half of the 20th century (N= 14), and every warning 
behavior was evident, the most frequent being pathway and fixation, the least frequent 
being direct threat. This was the first empirical application of the warning behaviors 
typology as a test of its ecological validity, but was retrospective by design. Research needs 
to continue to see if this theoretical typology has broad empirical value and organizes data 
in threat assessment cases in a pragmatic and helpful manner. 
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© Unstructured professional judgment relies on the notion of ipsi dixit, literally “He himself said it,” and is 
colloquially understood to mean the assessor knows it is true because he is the assessor and he knows best. 
This is a method of prediction that has been shown to have poor reliability and validity (Ennis & Litwack, 
1974; Faust, 1986; Grove & Meehl, 1996; Hanson, Morton, & Harris, 2003; Lidz, Mulvey, & Gardner, 
1993). Structured professional judgment has gained a foothold in the traditional violence risk approaches 
which are dependent on base rates and more historical factors. 
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